Vulnerability Description
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. *Note: this issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 61.0 |
| Mozilla | Firefox Esr | < 52.9 |
| Mozilla | Thunderbird | < 52.9 |
| Microsoft | Windows 10 | All versions |
References
- http://www.securityfocus.com/bid/104560Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041193Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1468217Issue TrackingPermissions RequiredVendor Advisory
- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39ExploitThird Party Advisory
- https://security.gentoo.org/glsa/201810-01Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-17/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-18/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory
- http://www.securityfocus.com/bid/104560Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041193Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1468217Issue TrackingPermissions RequiredVendor Advisory
- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39ExploitThird Party Advisory
- https://security.gentoo.org/glsa/201810-01Third Party Advisory
FAQ
What is CVE-2018-12368?
CVE-2018-12368 is a vulnerability with a CVSS score of 8.1 (HIGH). Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the wa...
How severe is CVE-2018-12368?
CVE-2018-12368 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12368?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Microsoft Windows 10.